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(51) Int. CI. 
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(1 1 ) S ^ ^2001 -0027902 
(43) ^Dmi^ 2001^04^06^ 


(21) m^^^ 

(22) m^mj^ 


10-1999-0039881 
1999^09^16^ 


(71) 

(72) ^SXF 
(77) ^A^§:? 


3^MmA\ aioie^ioi^ M^^m, 

135-877 

Mm i^y^ 4^^2§ 143-20 6# 
140-202 

/dM^^A|g6^^0|EHS!2^y^iH^gOHIf^iioei04s 


(54) 


MmJ\D\ ^ 91^ m^^^E^m o\mm 9iBm A^§x^ eje^f 3i mx\ as 



e ^^s^ eiEi^a ^^01 Q^9\ Mgxf3^ as>^E^ Mm±m oigsfiHi 3^ ^ei>^ g^soiiAis ^&^A^gxp^ >^ nn^^j ^(password) 

&>S eoH/d. e^Sm:?!! A^gX^ oje(user authentication) ^ Diffie-Hellman 51 ^xKkey agreement)^ 0I# 4^ 9l5^m a\^9.^ e^ 

P. s ui B:>ii2j oje H^SM oiM ojgg^ eaiej mm mnm mm ^^mo. s eje n^see ^ohai^ bh^^ 

2JH[ A^gX^ oje3f Sffll Diffie-Hellman XI4^(g'"(xy)(mod p))M e.^^!6^:HI mx\m 4^ 9iO. 5EH[. /ddl^ A^gX^ 0^0ICI2^ ^MxH 

BIS iIH>i?-IH(salted password)E^# THSmOl IIH:^?i?-IH m^'^l ^^^!^# SEe6^J}. A^gZf^ OFOIPS^ ej«l iiH>,o,cof« oi^g^ 

01 ^^as^:Hl eiee ma. mm ^mo\\ ^mm m?} o^u^l ^se^ s^oiis m^^^^ow am ^msixi mo, 21 
e H^sMM mm^\o\ a\^x[^ n^2\ o\o\as} m±^^m ^aieio^ Aibioii ^^^^ 4- mo. 

£3 

g^s. AfgXf oie. eie d\ ^xl. g:»H3l. iIH:^i^H. Diffie-Hellman 

SAIlAi 

£ 3 - A^gx^ qje 

:?l5JH(maQnetlc card)U ^D^e5^^(sma^t card)M Olgm^ DaiJa AfgXFSI ^xllS|5| sg, ^ xi^OlU mm Olg 

^xiPiyeie^s ^^SD. xl^:»l^^oleIlf se:>i&ieie°i m^m mmm iih^sh^je e'e:'is eoi 910. n mmME. ^iB^-jnii^ 
mm^owM^ =?m9} sjyi^B goi^^^ o\^[o\ A^gx^:^^ :f\^m 4^ nji^^^jsg mm Mmx}x\^D\^2imo\ A^gaoiaa. 3 
em 012} ^^g^ g>ii?>^fe^oiiAi iiH^^iHM 2i^m:H\ B^mn o\^o^ ^n^m 3^^o. 

0l2f fiH>i:?-JS2l :>H^M ?i6HAi nH^^^(passphrase)[ 1 ] , ^AIiI«^?-jH (one-time password)[2]. g:iHnH^?IH (public password 

)[3]. iIH^3H5fH[4] 3£IJ1 DH^^H ei^ H^£e[5] MBH :^I^M0l :)H^^a2i^U. n«^^^^ AFgX^:?} :'1^6H0^ BOi^l 

3:hi 5^0} xi^ esM. 3ai3 ^aioh^^^-isu s^hdh^^s. iih^^h^ih^ A\mx\D\ m^m^m ^e.^ ofubi nH^^-iHa^Mu im^ 
3H5iHe 4^xi6Hot 61^ esM hh^^^h eig Hsse^ eies s:»h5i s^. s^b y^si ^s. 3aj3 ^^^^^2? 

2ii^0IU HSMM B?il^ mm bIgM Q^t^Q. 5Ei^ 5ibllS:^(Kerberos)2f ei^Al^i^^ ^§5jo^ DlJ>t^H2| o^^SM 

mxi =&a[6i. 
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Exchange) 5SS»[7]S J^m A-EKE(Augmented-EKE) HSgS[8]g ^^xHas IIH-¥-l Xf^tt ^ 2i£^Soi M^li™™! rH 

sen ejea 4= act. stxi-j. b-speke^ ssi^ oi^ois°oi. p°i ^s-s flik^(p=2q+i fo!i~)S%mo ATsbp 

Ul B:>1IS OI^OJS smm Oiffie-Hellman 91 Ji\Smx\ StfeQ. 

S a^SOIIAIfe m OI^OO HSSSS SSHAH AJSXJ ^SU §a^g^ Oiffie-Hellman 51 ^*IB Ol^fe gfSS a^og gjp. 

tl] D.Feldmeier and P.Karn. "UNIX password security - ten years later." in Proc, Crypto 89. Springer LNCS 435, 1990. pp. 44-63. 
[2] Haller. "The S/Key one-time password systenn." in Proc. Symp. Network and Distributed System Security. San Diego. California. 199 

iSl^lSa^p^ 122-i3T."'''' "^"^^'""'^^^ co^ptography and password protocols." in Proc. ACM Conf. Comp. and Commun. Security}. 

[4] http://www.activcard.com/products/BMAS-ActivCard/index.html 

in^.toTi?; n'^o.Tpp: 64S-65?Tune"?99a '^"'^'^ """^ S"^^^'"^ attacks." IEEE J. Select. Area Comm 

[6] T.Wu. "A real world analysis of Kerberos password security." Internet Society Symp. on Network and Distributed Sys. Security. 1999. 
[7] US5241599: Cryptographic protocol for secure communications (invented by S.Bellovin and M.Merritt. AT&T) 
[8] US5440635: Cryptographic protocol for remote authentication (invented by S.Bellovin and I^.Merritt. AT&T) 

[gmoiffie and M.Hellman. "New Directions in Cryptography." IEEE Transactions on Information Theory. Vol.22. No.6. pp.644-654. Nov 

[10] D.Jablon. "Extended password key exchange protocols." WETICE Workshop on Enterprise Security, 1997. 

[11] T.Wu. "Secure remote password protocol," Internet Society Symp. on Network and Distributed Sys. Security. 1998. 

I Jilt MimmmmtiSS. ^° ^ ^is^f ^^^9, a^i, oi^i,, g,^. ui^iM cisa a 

1. Ul 9J1ISI flH^*IS 91m HSSaS SoH/H Diffie-Hellman Xl^ ^^(mod/?)* ^'^"^ ^ 

2. ±4^ pmi^mSW e.^^!g^ ±^ p=2q+1 for ,^ ^as SSSfOI. non-smooth ^^-f'SE e^^S^E* 

^^^^^ OJOICia #^XHaig! m^^i^PJm Jimm. MSXI^ OiOICISI mm uH^ojcej^ oj^SfOt o|=s mg:^ «Xi 

4. ejs Hsssa ssshoi Ais»:?i xt6i°i omasi iw^i^iHs saieiss Aitnoii mmm ^ 9izm itu. 

^SMStm at aaioieis se^si Aisxj. eigai- aiw ss^^ ^agw aiSxTm^^s sS^° iS5 
^ s§^:l^ §6Ha a^^a ssha) sshs oiiaixi* ui sa. 

1. eis^s spia g^B 

£ 1 

s ^921 eis^s s:»iafe [esh uaj soi oi^oixio). aafoias ss^sj Aim es^^t bhs ess s&mon &a = "►'^oi oi- u,^ 

© seioieie ss«a aiw gg^t at at s.m^^ smm smtia. 
® meio\&m gg^a Mm sg^fe s 0<y(:'KS.^) ss« segfa. 

® aaoieis gs^2i AitH sgvfc ifth saa gg^g iSH4ie^2i ois cigsife ^^E^t^ 2mm zmma. 

® satoias ss^a Aim ssvfe ^is s^kxcr) a^s ss&d. 

f fi^°l^^ Sf t^,^*?^? &aSf^°S SIAfy4=S4SP|(pseudo-random number generator) 2SM SgfgfQ oi SMS 

iHi>i9is(s)a as a:>i2i y4.(t)a sfs y4»(a)g assioi. i<r.x.y<p-i s^ioiiah s y4=(r,x,y)» ^-amu. ^^'^ 
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"® ea}oie<M ee^a Mm mm^^ s,mm 

® ^eiOieje gg^2^ Mm eS^^ ^5^*ll(f^nite field) GF(p)2l ^Aie (primitive root) qM SS§hQ. 

® ea}oi2<M ee^^ i <2<p-i2i ^mmM e zm ^mu^imM SAie goii gi. ^^(j^odp)^ s&e^p. 
2. iQI>t?IH gBiei g^ 

£ 2 

^ ^^S2J im>^?-IH [£511 2]2} ^01 OI^CHXIW. AfgX^^ MBI0|OjM gg^M g6HAi Aitii gg^Oll XF6]oj OFOIUSf iOI 

geiei^^ g^ar^ii so. aeiej mm^ a^2j ^<i^3^ sbh ej^ s&moi ojsfAi sq Aizfg Q^mxi 
© A^gx^^ xr<y°j omia(id)2f nH>t^H(s)e ^ MHfoie<M gg«oj Mm7^?iBm\o\^m mmM a^s^Q. 

® (DeaiOiejM gg^^ 1<r<p-l2| ^?IOIlAi S2]°J e ^4^ re ^d^tt ^ ^t^^I^^O^IAi ^AI2 gOII -^(^'-(mod/?)^^^-^ ''^^^ 
^ ^ ^^(mod/.)*^' --^feTCmodpy^^'^- (ii)e2fO|o^M gg^^^ if^ klOe 2^(^-(^odi^)>^' --^^ * iIH-9IH(s)S>f XO 
R ^6^8^32. Olg^il o4<yt^ 2i(s XOR ^^''(ixiodi?)^^ ^^^^^ ^'^^^'"(modjc^y^' ^'^ Mg5K)t M^&^Sfe^Q. 

k1()3f k2(fe etBet &4^SA1. 2^011 CfleHAi Ai^ S^M ^S§^D- (iii)eaf 012!^ gg^^ StM 0\0\a ^ ^{ 

^'"(mod/^y^ SJHl Mm gg^OIITll S^t^O. (iv)Aim gg^^ XH§@ mz)m ^^^'•(mod/^y^' ^ 

(^'/(mod/^y^' ^'"^ "^^^^-^ ^^^^ ^gSHAI Ss^M ^saSFOl iOI>^9IH(s)M ^^D. 

®. ®, ® AitH gg^^ y4^(t)M ^SaHAi ^^gfo^ MgSPI ?loH iIHi5i9-!H(s)2f XORt[ ^(s XOR t). ^^W ®-(iv)011Ai ^SSJ^ HH^^^C 
s)o| gf^ig ^6HAi AhgXf oj^ g^gSJ Mie^Jie 4-St^□. BXI Oi:'IA1 HSSMSI y4=^(a)M IS II^(a=1)E^□. C«t[ XFAIlE^ 

© oie HSSeol ^g2|os gsm^ 3^ #^xH£|@ iIH>t9IHSAi 2i(s XOR t) ^ ^^g\rnodpi^^ ^^^^ 0F0ICI(id)2f XiS& 

□ . 2t(v)fe iiH^9IS(s)2[ #M(t)e §8fl2 f()OII StOIOI. 84^ f()^ OlgmO* 2^3f^ S<^SAi 

blM^OlM Pohlig-Hellman OliiKIil^^MoHOII CHeHAi ehSsHE^ S^H^ ^^^M mO. &^2J ^§21 3SSI A^gXT eig 



3. AFgx^ 2im 

£ 3 

^ AhgX^ o]e [£6H 3]3f ^01 OI¥OiX|Ql. AFgXf^ #810121^ gg^OII 0^0ICI(id)2f fiH:i^?JH(s)&^M S^SHAI oje^^IHI 9 

P. 

® A^gxf^ :?|2^s^32 21^ dh^9ih(s)m x^6l2l omiaod)^ swi eefoieis gg^si MgxfejaiHioi^iM sshai a^s^p. 

(D (oesioioie gg^^ y^(a)# ^d^mn ojoip(id)2f mm Mmmow s^e^p. (iOMeioieje gg^^ 1 <x<p-i g?io«Ai y4^(x)M ^ 

® (i)AibH gg^^ o^olCl(^d)g ^oi^is MgsHAi 7H§@ st(s XOR t)2> ^.^(^^(rnodp)^^ i^oieeiD. (ii)Aim gg^^ 1 <y<p-i mm 

0\\M \^^Mm m ^M^iom -^(^(mod/7y°^^' ^^^^^ ^'^^''(mod^)^^ ^- ^ ^^^^ ^^^^ ^( 

^-^^^^''(mod/?)^^ MfifOieiS gg¥Oii:HI ^^H^P. (iii)AiW gg^^^ St(y)M ^^(^"(mod/^y^' 

(4) (OeeiOiei^ gg^^ 2^(s XOR t)^¥Q ^i^2i(t)M ^t.^ ^((s XOR t) XOR s = t) MgXf irH^^H(s)2f #^2i(t)M &4^f()01l ^Jgmoi 
2.^(v)M ^^§}a. f()^ i^*} ^^^1.^ 6H4H&4^ h()M OlgS^^ el4=^Ai f(s.t)=h(t.h(s.t)).h(s.t)2f ^01 =?^9\0\ 2i(s)2f St(t 

)S^£i 2i(h(t.h(s.t)).h(s.t))M ^^t^P. (iDMBiOiei^ gg^^ eiAie(g)Oil -^5^^«t^*'(mod/?)^ ^'^^^^ 

a*^^(mod/.)'- ^^'^ ^^V+^*^^(modpy<«'^ V+«*^Vi*^^(mod/.)=^^(mod/7y^^ ^^^^ 
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0.^^ ^^^^ ^V(xnodp))^' ^^^^^ ^^^(^^)^Cmodp))^^^ ^^^^^(xnod^))^ ^^^^^^^^-(^)^(modp)). ^V(mod^) 
)OII 2^(x)M ^^((g^)-(jnodpy°^^ ^'V+a*g\modpy^ mod/7 5H^2i(hash1)^ ^^.^Q. (,V) eafO|cye gg« 

^ ^'^g^4-(g^)^(mod/7y^ 5H4l2^(hashl)M AftH gg¥OII9il ^^^E^c:f. 

2i(y)S 2^(^-(niodp)^^' "^^^^^(^TCmodpy 5H^2i(hash1)^ ^oHAi ^^Jg 6H4H2iI!f UIBt^a. (m)AHai ee^fe 2.^01 ^'xl 
'^^^^ ^--^^^ ^^^s'^\modp9 ^^^^^^^ (iv)AiH^ ee^^ ^^^^-(^)\modpy^ UT(mod/.))^ 

(57) §^31 

@ gaioioie Aim ee^oii ohoici(id)2f y4^(a)s ^mmo. 

g^+a*g (mod/?) 

Hsr) (mod/7)' mod/7) (^) (mod/?)^^* ^^e^Q. 

g '^(g;) (modp) ) (mod/7y^= -^-u. 

S^ir 2. 

^^S2| 21^^ [£5H 2]2J gdfoi «hg ®(D(D®(5)(6). 
® AfgXP^ MdfOiei^ gg^Oil OmiC|(td)2f iIH^?-IH(s)S 

^+a*^ (mod/?)^^ -s^i-f. 
(DeaiO,^^eg^.^AH^ee^.l^V-(^)^(mod/.)' V-a*^^(n.od/.). (^)^(^od/,)))^- ^^^^^^• 
d) Aim eg^^liH::^?4SZhgXi§g^K}il g^^Od, sXORt. V. . OS XlSEhCf 

g (^modP^ o I- ^ . 

S^S 3. 

^im^SJ @2| DilAIXI 

(DsXORt. V. , . 

^-^a*g (mod/7) 

4. 

®^"-^(^)\mod/7) 
5. 

^^i.^ M2m2\ ®oj OlIAIXI ^g. 

® {s XOR k1( v._^>,r, , x)} k2( ^ r^r^ , ) 

) (mod/7)^^-*'^^(^^)'^(mod/7y 

6. 

S^i^ XlMi>^2i (D(3)3f y4^(a)M ^^JtllE^ 4^ 2ife g^g. 

(D id 
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7. 

fliisa ®@®3i HI2S2I s^g Hi3§fa m=?m ma^s gf4'f{s.t)2i ss. 

f(s.t)= h(t.h(s.t)) . h{s.t) 
8. 

S^g fll2Sa ©a S4= k1(x)2t k2(x)°J SS. 

k1(x)fe x2l msb(most significant biO^H flH^?IH(s) 3:)\ S}g2| blSgg aeigJD. 

K2(x)fe x2i Isbdist significant bit)^Ei S*gfsa^Jieig2| 91 3:71 BfM2| dlSgg ^d§!&a. 
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£3 2 
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3 
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id, s 



id , a 



s®t ^ g-' +a*g*'(mod/j) 
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